#VU21200 Command Injection in Advantech WebAccess


Published: 2019-09-19

Vulnerability identifier: #VU21200

Vulnerability risk: High

CVSSv3.1: 7.7 [CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C]

CVE-ID: CVE-2019-13552

CWE-ID: CWE-77

Exploitation vector: Network

Exploit availability: No

Vulnerable software:
Advantech WebAccess
Server applications / SCADA systems

Vendor: Advantech Co., Ltd

Description

The vulnerability allows a remote attacker to execute arbitrary code on the target system.

The vulnerability exists due to a lack of proper validation of user-supplied data. A remote authenticated attacker can delete files on the system and execute arbitrary code.

Mitigation
Install updates from vendor's website.

Vulnerable software versions

Advantech WebAccess: 6.0-2007.06.05 - 8.4.1

External links
http://www.us-cert.gov/ics/advisories/icsa-19-260-01

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote authenticated user via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.


Latest bulletins with this vulnerability


Multiple vulnerabilities in Advantech WebAccess